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ABSTRACT 

Aviation and cognitive science researchers have identified 
situations in which the pilot’s expectations for the 
behavior of the avionics are not matched by the actual 
behavior of the avionics. Researchers have attributed 
these “automation surprises” to the complexity of the 
avionics mode logic, the absence of complete training, 
limitations in cockpit displays, and ad-hoc conceptual 
models of the avionics. 

Complete canonical rule-based descriptions of the 
behavior of the autopilot provide the basis for 
understanding the perceived complexity of the autopilots, 
the differences between the pilot’s and autopilot’s 
conceptual models, and the limitations in training 
materials and cockpit displays. 

This paper compares the behavior of the autopilot Vertical 
Speed/Flight Path Angle (VS-FPA) mode as described in 
the Flight Crew Operators Manual (FCOM) and the actual 
behavior of the VS-FPA mode defined in the autopilot 
software. This example demonstrates the use of the 
Operational Procedure Model (OPM) as a method for 
using the requirements specification for the design of the 
software logic as information requirements for training. 

1. INTRODUCTION 

The FAA report, Interfaces Between Flightcrews and 
Modem Flightdeck Systems [4], identifies issues 
associated with pilot’s management of automation (pages 
33 to 41). The report catalogues gaps in pilot’s 
understanding of the capabilities, the limitations, the 
modes, and the operating principles and techniques of 
modem cockpit automation. The report describes 
“automation surprises” where the automation behaved in 
ways the flight crew did not expect. As an example, the 
report cites Wiener’s [12] studies where frequently asked 
questions of the of the avionics behavior: “What is it 
doing now?” “Why is it doing that?” and “What’s it 
going to do next?” The report also describes differing 
pilot decisions about the appropriate levels of automation 
and the different assumptions made by manufacturers in 
designing these systems. 


These issues with the cooperation between pilots and 
avionics are demonstrated by airline policies that prohibit 
use of certain parts of the automation, and by pilots who 
choose not to use parts of the automation [3], [6]. 

Researchers have cited the limits of human cognition, 
operational complexity, ad-hoc conceptual models of the 
avionics, and limitations in the content and form of 
cockpit displays and training materials as factors 
contributing to “automation surprise” events. Cockpit 
displays and training material are the primary source of 
the structure and content of the pilots’ mental model of 
the operation of the avionics. The constructs, grammars, 
and visual representation of this information are critical to 
the formulation of accurate, rapid, complex, flexible, and 
meaningful pilot mental models. 

Content and Form of Training Material 

Airframers and airline operators have traditionally avoided 
the conceptual model issue by only providing training for 
the basic operating techniques of the automation. Pilots 
are given the knowledge to perform certain “critical” tasks 
with the avionics and then required to develop their own 
mental model through operational “line” flying and the 
operator manuals provided by the manufacturer and/or 
airline. 

The official source of information on the operation of the 
avionics is the Flight Crew Operators Manual (FCOM). 
The FCOM is written and published by the airframe 
manufacturer. Airlines typically republish adapted 
versions of the airframers FCOM with additional airline 
specific information, policies and procedures. 

The FCOM is required to include a wide range of 
information: 

description of the cockpit panels and displays 
procedures (normal operation) for each phase of flight 
procedures (abnormal and emergency operation) for 
each phase of flight 
checklists 

description of the modes and the behavior of the 

modes of the aircraft systems 

description of the architecture of the aircraft systems 


An FCOM is typically developed during flight-test and 
certification of an aircraft or new equipment. The 
developers of the FCOM, with training and publishing 
backgrounds, work with specifications of the system 
furnished by the engineers and with expert pilots. 
Frequently sections of the FCOM can be derived from 
earlier generations or manuals from other airplanes [7]. 
Following iteration and the review and certification 
processes, the final version of the manuals is made 
available for publication and distribution. Updates to the 
manuals are provided to pilots with additional 
information about new avionics loads and improved 
sections. 

The authors of the FCOM are faced with a number of 
human-factors issues in capturing and presenting the 
information in readable, understandable formats. In 
addition, the FCOM is required to serve as both a means 
for educating the beginner as well as a reference source for 
the expert operator. 

2. CANONICAL RULE BASED DESCRIPTIONS 
OF THE AVIONICS 

The specification of avionics systems include numerous 
rules made by the designers of the system about how the 
aircraft should “behave” in certain situations. This 
decision logic can be organized as a canonical rule-based 
description, which can serve multiple purposes, including 
the generation of training material. Sherry [8] introduced 
a canonical rule-based, situation-action pair representation 
to describe the behavior of avionics: 

Intention =f (situations, actions) 

Where: situations => conditions when an action 

will be taken 

actions => commands, changes to 
displays or symbolic data structures 

The situation part of the rule represents the overall 
operational condition that the aircraft is in. The situation 
is defined based on parameters that include: aircraft 
altitude, aircraft speeds, the location of the aircraft in the 
flightplan, the configuration of the cockpit, and state of 
the on-board equipment and sensors. 

Given a situation, the avionics executes an associated set 
of actions. Actions include: pitch/thrust/roll commands, 
modification to the flightplan, and new 
speed/altitude/vertical speed target. 

This canonical representation also includes information on 
the intention of the action. This information is useful in 
abstracting complex, detailed situation-action pairs with 
an operational objective. 

An example situation-action rule for an autopilot Vertical 
Speed mode is illustrated in Figure 1. As is evident in 


this example, canonical situation-action pair 
representations of the behavior of autopilots are 
dominated by the descriptions of the situation. In the 
actual avionics software, up to 80% of the behavior of the 
avionics is based on conditional IF-THEN-ELSE 
constructs and logical equations. The remaining 20% of 
the behavior of the avionics is associated with repetitive 
tasks (such as closed-loop control of pitch), optimization 
(such as ECON speeds), symbolic manipulation of data 
(such as the Flightplan and cockpit displays). 

Intention: Honor pilot request to maintain pilot entered 

Vertical Speed to pilot entered Altitude at pilot 
entered speed. 

Situation : Pilot selects the Pitch Wheel above 400ft RA 

and below 1500ft AGL when the Autopilot is 
engaged in Takeoff. Go Around, Level Change, 
Altitude Hold, or Altitude Capture 

This situation shall occur when all of the following conditions 
are satisfied: 

a) Aircraft Altitude is between 400ft Radio Altitude and 
1500ft Baro Altitude 

a) Aircraft speed is between Vmin + 5 knots and Vmax + 

5 knots 

Comment: Aircraft speed has not violated the speed envelope. 

:) Predicted Aircraft speed in 10 seconds is between 
Vmin + 5 knots and Vmax + 5 knots 
1) Aircraft is not within the Altitude Capture or Hold 
region 

a) Autopilot remains engaged 

: ) PROF mode remains not engaged 

3 ) GCP Pitch Wheel is rotated 

a) Radio Altitude is valid 

) Autopilot Pitch Mode is Takeoff, Go Around, Level 
Change, VS/FPA, Altitude Capture, Altitude Hold, 
Giideslope, Nose Lowering, or Flare. 

Action: 

Closed-loop control of vertical speed using pitch 
Closed-loop control of speed using throttles 
Flight Mode Annunciation “THRUST | VS” 

Example situation-action rule for autopilot vertical 
speed mode. 

Figure 1 


Complete and Approximate Descriptions of Behavior 

A canonical situation-action pair description of the 
behavior of a system is considered to be complete when 
all the possible situations that can occur in a mission are 
included in the description. 



Operational 

Procedures 

Transition to VSFPA 



5 

Vertical Speed 
Wheel on the FCP 
is Selected when 
Autopilot or Flight 
Director is 
Engaged in an 
Altitude Capture 
when radio 
Altitude is Invalid 
and the Change in 
VS places the 
Aircraft Outside 
of the Capture 
Region of the 
Selected Altitude 

7 

Autopilot or Flight 
Director are 
Engaged in Takeoff, 
Go Around, or 
Windshear Pitch 
Modes and the 
Aircraft is Greater 
than 400ft AGL with 
VS is Greater than 
+/-300 fpm. 

.14 

Aircraft speed 
violates Vmin 
-5 knots 

15 

Aircraft Speed 
Exceeds Vmo/Mmo 
+5 knots. 

Scenario 

Inputs 

States 





V/S on GCP 

Is selected 

Is selected 




Is not selected 





Altitude 
Capture revert 
to VS-FPA 

Invoked 

Invoked 




Not Invoked 





Radio Altitude 
Estimate 

Valid 


Valid 



Not Valid 

Not Valid 




Radio Altitude 
Estimate 

> 400ft 


> 400ft 



< 400ft 





Pitch mode 

Takeoff 

Takeoff 

Takeoff 



Go-Around 

Go-Around 

Go-Around 



Level Change 

Level Change 

Level Change 

Level Change 

Level Change 

Windshear 





Others 

Others 

Others 



Aircraft Speed 

<Vmin -5 knots 



<Vmin -5 knots 


>Vmin -5 knots 





Aircraft Speed 

<Vmax +5 knots 





>Vmax +5 knots 




>Vmax +5 knots 







Behavior 

Outputs 






VSFPA Pitch 

Transition 

Transition 

Transition 

Transition 

Transition 

No Transition 






Example Portion of Operational Procedure Table for Autopilot Vertical Speed Mode. 


An illustration of a method for formally validating 
completeness is shown in the Operational Procedure Table 
(OPT) example, Table 1. Mathematical models 
underlying the model verify that for each situation there is 
one and only one corresponding action. 

The possible situations in a mission are defined as every 
possible combination of values held by the parameters 
that have been identified to be relevant to the behavior. 
In the example in Table 1, aircraft radio altitude validity 
and aircraft relation to 400ft, V/S wheel selection on the 
Glareshield Control Panel (GCP), invocation of altitude 


Table 1 

capture aircraft speed relative to V m ax and V miI1 are 
examples of parameters and their values. 


A canonical situation-action pair description of the 
behavior of a system is considered approximate when 
either: (i) all the relevant parameters are not included (i.e. 
descriptions of situations are simplified), or (ii) all the 
possible values of these parameters are not covered by a 
situation (i.e. situations are missing). 

3. RULE-BASED DESCRIPTION OF THE 
VERTICAL SPEED PITCH MODES OF A 
MODERN AUTOPILOT 




Autopilots in modem “glass cockpits” include modes of 
operation that coordinate control of the pitch and thrust 
axes. Level Change, Altitude Capture, Altitude Hold, 
and Vertical Speed/Flight Path Angle pitch modes are 
known as the Cruise Pitch Modes. These pitch modes are 
available when the aircraft is greater than 400 ft AGL 
when the Radio Altitude is valid and Takeoff, Go 
Around, Windshear pitch modes are not engaged (or at 
any altitude when Radio Altitude is not valid and 
Takeoff, Go Around, Windshear pitch modes are not 
engaged). 

A cruise pitch mode may be engaged, disengaged or 
inhibited from engaging. Hutchins [6] has examined pilot 
difficulty in determining which criteria have been 
satisfied. 

A total of 252 mission situations affect the cruise pitch 
modes. These 25 scenarios are based on 62 parameters. 
The engagement/ disengagement situations and the 
number of parameters used in the rules for each cruise 
pitch mode are summarized in Table 2. The rales for 
engagement/ disengagement of Level Change are the 
simplest. The rales for the engagement/disengagement of 
Altitude Hold are the most complex. 


Pitch Cruise Mode 

Situations for 
Engagement/ 
Disengagement of 
Pitch Mode 

Parameters 

To Level Change 

23/9 

15 

To Altitude Capture 

50/30 

21 

To Altitude Hold 

88/23 

21 

To Vertical Speed/ 
Flight Path Angle 

16/13 

20 


Summary of Rules in Autopilot VS/FPA mode. 
Table 2 


A typical description in the FCOM of the operation of the 
Vertical Speed Mode for a modern autopilot is illustrated 
in the left side “boxed section of Figure 2. 

Mixed Content Descriptions 

The description in the FCOM includes a lot of different 
types of information. The different types of information 
are not separated. They are intertwined in a narrative 
description. The different types of information are 
summarized below: 

pilot operation of the Mode Control Panel (MCP) 
the Flight Mode annunciation 
behavior of the autothrottle 
behavior of the Vertical Speed Mode 

Buried Rule-based Description 

The FCOM description of behavior of the Vertical Speed 
Mode is included in narrative form. The conditional rules 


for operation, underlined in Figure 2, are not highlighted 
and difficult to separate into rules. 

Given the incomplete nature of the training materials and 
the type of training that is currently given, currently 
pilots receive insufficient knowledge for the development 
of complete and accurate mental models of the avionics. 

Approximate Descriptions 

The current FCOM description of the behavior of the 
Vertical Speed Mode is an approximate and incomplete 
description. The FCOM includes 12 of the 16 situations 
in the actual software for engagement of the mode, and 4 
of the 12 situations in the actual software in which the 
selection of the mode is inhibited or in which the mode is 
automatically disengaged. 

The FCOM description of behavior is based on 9 
parameters. The description of behavior of the avionics 
software is based on 12 parameters. It is easy to see that 
it is extremely difficult for a pilot to develop an accurate 
mental model of the avionics without a complete and 
accurate description of the behavior of the avionics. 

Viewing these parameters, it is evident that the 
operational complexity in the behavior of the autopilot is 
necessary given the constraints in aviation. The behavior 
of the autopilot is determined by parameters that represent 
the environment (terrain and weather), aircraft dynamics, 
pilot delegation of authority to the automation, 
operational procedures, and technologies that enhance 
capacity and safety (e.g. glideslope). Therefore, reduction 
in operational complexity would be possible only with a 
reduction in functionality. 

4. CONCLUSIONS 

A reduction in perceived complexity may be achieved by 
reducing or eliminating differences between pilots’ 
operational models and the operational models encoded in 
the autopilot. Complete rule-based descriptions of the 
behavior of the autopilot provide the basis for 
understanding the perceived complexity of the autopilots, 
differences between pilot and autopilot conceptual 
models, and the limitations in training materials and 
cockpit displays. 

The most powerful means pilots have of learning the 
behavior of the autopilot is through observation. When 
the cockpit displays do not annunciate a complete 
canonical intention-situation-action behavior of the 
autopilot, the pilot is left to create approximate models of 
the autopilot’s behavior. Due to the nature of the logical, 
decision-making of situation assessment, it is very 
difficult to generalize behavior in a meaningful way. 
Small changes in the value of a parameter used in 
situation assessment can result in significantly different 
actions. Feary, et. al. [5] have demonstrated the value of 
this approach. 




To support pilots learning complete canonical 
descriptions of the behavior, Sherry & Poison [10] 
propose using interactive, computer-based training to 
incrementally increase the pilots’ mental model. Modem 



Operational Procedural Knowledge: 


Scenario Conditions 


Pitch Wheel: When rotated slowly, results in lOOfpm or .1 degree change 
per detent. In level flight with FD and or AP/FD on, initial wheel rotation 
selects V/S mode in 100s of fpm or FPA in degrees in the direction of 
wheel rotation. In a climb or descent greater than 300fmn. the mode and 
disdav are initialized to the current V/S or FPA when either the AP or FD 

are eneaeed. Once enaaaed. the disdaved value is alwavs the selected 

value. Selection of V/S-FPA mode disenaaaes PROF, sneed-on-nitch 
(PITCH in the FMA speed window), altitude hold and glideslope modes 
if LAND is not annunciated. Autothrottles revert to speed control 
(THRUST in FMA window!. Reselectina PROF resumes FMS descent 
profile operation at the vertical speed as a FMS edit. 

Rotation of the pitch wheel causes the aircraft to depart the FCP selected 

altitude in vertical speed or flight oath angle mode WITHOUT A FLOOR 

OR CEILING ALTITUDE. Rotation of the pitch wheel enables the pilot to 

exit altitude capture for 2 seconds where upon if altitude capture 

conditions are satisfied, the aircraft reenters altitude capture. Otherwise 

the vertical speed remains selected. This feature is operable in all modes 

except dual flight directors control below 1500 ft. SINGLE or DUAL 

LAND and below 400ft RA in the pitch autopilot or flight director 

takeoff or go around modes. 



| Engagement Scenarios 
j 7,8, and9 


I Engagement Scenarios 

| 10 , 11,12 

| Engagement Scenarios 
| 1,2,3 

| Engagement Scenario 
| 4,5, 6 

| Inhibit Scenarios 
| 17,18,21,22,23 

Missing: 

Engagement Scenarios 13-16 
Inhibit Scenarios 19, 20, 24-28 


Other Knowledge in the FCOM 


Howthe VS Wheel works 


Pitch Wheel: When rotated slowly, results in lOOfpm or .1 degree change 
per detent. In level flight with FD and or AP/FD on. initial wheel rotation 
selects V/S mode in 100s of fpm or FPA in degrees in the direction of 
wheel rotation . In a climb or descent greater than 300tpm . the mode and 
display are initialized to the current V/S or FPA when either the AP or FD 
are engaged. Once engaged, the displayed value is always the selected 
value . Selection of V/S-FPA mode disengages PROF, speed-on-pitch 
(PITCH in the FMA speed window!, altitude hold and glideslope modes if 
LAND is not annunciated . Autothrottles revert to speed control (THRUST 
in FMA window!. Reselecting PROF resumes FMS descent profile 
operation at the selected vertical speed as a FMS edit . 

Rotation of the pitch wheel causes the aircraft to depart the FCP selected 
altitude in vertical speed or flight path angle mode WITHOUT A FLOOR 
OR CEILING ALTITUDE. Rotation of the pitch wheel enables the pilot to 
exit altitude capture for 2 seconds where upon if altitude capture 
conditions are satisfied, the aircraft reenters altitude capture. Otherwise 
the vertical speed remains selected. This feature is operable in all modes 
except dual flight directors control below 1500 ft, SINGLE or DUAL 
LAND and below 400ft RA in the pitch autopilot or flight director takeoff 
or go around modes. 


How the VS-EPA display works 
Pitch Mode disengaged 
Thrust axis operation 
PROFMode VS Targets 


Example FCOM for Autopilot Vertical 
Speed Mode. Underlined text provides 
approximate model description of the 
behavior of this mode. 

Figure 2 





theories of complex skill acquisition [1] suggest that it is 
reasonable to assume that pilots can learn to anticipate 
and monitor the behavior of large rule-based systems. 
Typical users of PC spreadsheets make use of 
approximately 300 rules. Grand master chess players 
(those who have studied chess intensely for at least 10 
years) have mental-models that include 10, 000 to 100, 
000 rules of behavior [2]. There are similarities between 
pilot’s training, both formal and on-the-job, and the types 
of training which office automation users and chess 
players perform that strengthens this assertion. 
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The relationship between the jurisdiction of pilots’ 
models of the operation of the mission and the 
jurisdiction of models encoded into the autopilot is a key 
determinant of pilot-avionics cooperation. When the 
conceptual models have no overlap there is no chance for 
“operator-automation disagreement.” When the pilot’s 
and the autopilot’s operational models overlap, such as 
speed protection, differences in these models can result in 
“operator-automation disagreements.” When these 
disagreements are not annunciated, “operator-automation 
surprises” occur. 



